Cookie Policy

fanli_session keeps signed-in accounts authenticated. It is HttpOnly, Secure in production and SameSite=Lax, applies across the site and expires after seven days by default; the permitted configuration range is five minutes to 30 days.

__Host-fanli_google_oauth stores signed OAuth security state, nonce and PKCE information for up to ten minutes. It is HttpOnly, Secure, SameSite=Lax, scoped to / and deleted when the callback is consumed.

fanli_admin_session is set only for the separate staff administration area. It is HttpOnly, Secure in production, SameSite=Strict, technically scoped to / and expires after no more than eight hours. Ordinary visitors do not receive it.

This release does not enable browser analytics, advertising pixels, marketing cookies or other non-essential storage or access technologies. Fanli therefore does not currently show a cookie consent window. This policy remains available from each Fanli country site footer.

Before any non-essential technology is introduced, the provider, purpose and duration must be documented and a prior, freely given and withdrawable choice implemented under PECR and UK GDPR.

You can delete or block cookies in your browser. Public pages and legal information remain available without cookies. Email registration and verification may complete, but the browser cannot remain signed in afterwards. Google sign-in and registration and signed-in account features, including account-based cashback attribution, are unavailable without essential cookies.

When you open Google's sign-in service, Google may use cookies on its own domain under its own notice. After a GoShop click, the store you visit may use its own cookies or similar technology. Those third-party technologies are not controlled by this Fanli policy.